Separate address, route, port, and protocol

Four questions narrow many failures quickly: Did the name resolve to the intended address? Is there a route to that address? Is the correct transport port reachable? Does the application speak the expected protocol?

Each question can fail independently. An IP address can be correct while the route is wrong. A route can work while a firewall blocks TCP port 443. TCP can connect while the server sends an invalid HTTP response. Fixing the wrong one wastes time and often breaks something that was fine.

Error messages already classify the failure

The good news: most tools tell you which question failed, if you read the error instead of skimming it.

Could not resolve host              -> address (DNS)
No route to host                    -> route
Connection refused                  -> port (reached the host; nothing listening)
Connection timed out                -> route or a silent firewall
certificate verify failed           -> protocol (TLS, above transport)
502 Bad Gateway                     -> protocol (HTTP reached an application)

Connection refused is oddly reassuring: the address was right, the route worked, and the destination actively answered “no process here”. You’re one layer from success. A timeout is murkier — packets vanished, either because routing is broken or a firewall drops silently.

Run one deliberate failure so you recognize the shape:

curl --connect-timeout 3 https://flaviocopes.com:9999/
# curl: (28) Failed to connect ... after 3002 ms: Timeout was reached

Name resolved, route existed, but port 9999 answered nothing. Address: fine. Route: fine. Port: failed. Protocol: never got a chance. That’s a classification, and it tells you where to look next — a firewall or the server’s listening configuration, not DNS.

Layers above transport

TLS and authentication add more boundaries above the transport connection. A certificate error is not evidence that IP routing failed; it means the conversation reached a later stage. The same logic applies to a 401 Unauthorized or a 500: those are application answers, delivered over a perfectly working network.

The order matters. A failure at one stage makes all later stages unreachable, so the first failing stage is the only one worth investigating.

Write down the first failing stage

Write down the first stage that fails, in one sentence: “DNS returns the right address, TCP to port 443 times out.” This keeps a precise transport failure from becoming an uncontrolled rewrite of DNS, routing, and firewall configuration.

The people who fix network problems fast aren’t running more commands than you. They classify first, then aim. Changing configuration before classifying is how a one-line firewall fix turns into an evening of self-inflicted outages.